Re: [PATCH] can: dev: can_put_echo_skb(): free skb on invalid echo index

On Thu. 30 juil. 2026 at 17:03, Cunhao Lu <[email protected]> wrote:
>
> can_put_echo_skb() consumes the skb on all paths except when the echo index
> is out of bounds. This leaves ownership with the caller on -EINVAL, unlike
> the other error paths, and can leak the skb if the caller expects
> consistent semantics.
>
> Free the skb before returning -EINVAL so that all return paths consume it.
>
> Fixes: 6411959c10fe ("can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds")
> Cc: [email protected]

This branch is just a safety net meant to never be reached. While the
fix logically makes sense, this doesn't strictly require a backport.
That said, I am not against this being backported if the stable team
is fine with it.

> Signed-off-by: Cunhao Lu <[email protected]>

Reviewed-by: Vincent Mailhol <[email protected]>

> ---
>  drivers/net/can/dev/skb.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/net/can/dev/skb.c b/drivers/net/can/dev/skb.c
> index 95fcdc1026f8..44ebeba99837 100644
> --- a/drivers/net/can/dev/skb.c
> +++ b/drivers/net/can/dev/skb.c
> @@ -54,6 +54,7 @@ int can_put_echo_skb(struct sk_buff *skb, struct net_device *dev,
>         if (idx >= priv->echo_skb_max) {
>                 netdev_err(dev, "%s: BUG! Trying to access can_priv::echo_skb out of bounds (%u/max %u)\n",
>                            __func__, idx, priv->echo_skb_max);
> +               kfree_skb(skb);
>                 return -EINVAL;
>         }

Yours sincerely,
Vincent Mailhol